This document stipulates the rules, which EXCEDO TRAVEL EOOD, with seat and registered address in Bulgaria, Sofia, Mladost 1, bl. 35, ap. 31, UIN 203315188 (hereinafter Excedo), shall apply towards Client of the services it offers such as, but not limited to:
- Organized tourist visits of sites and locations as explicitly announced in advance for a certain route;
- Performance of specific sport activities within the organized trips, including such activities with extreme or special physical requirements;
- Guided tours of sites and locations in the language specified in advance for the respective package;
- Ensuring the necessary specialized equipment (if applicable) for performance of the sport activities provided to the Client by Excedo;
- Instructions and supervision during the performance of the sports and other activities under this GTC and the respective package chosen by the Client;
- Individual Products mutually agreed upon and according to the specific requirements of the Client.
Art. 1. (1) Excedo collects and processes Clients’ personal data on the grounds of Art. 4, Para. 1, Pt. 2 and 3 of the Law for Protection of Personal Data and more specifically based on the following:
- Client’s explicit consent;
- Excedo’s performance of their obligations towards Clients under the respective service agreements.
(2) By accepting the General Terms and Conditions of the services provided by Excedo, Clients expressly agree that Excedo would be entitled to process personal data, disclosed by Clients with the conclusion of the booking contract.
(3) Excedo is registered as a personal data administrator with the Commission for Personal Data Protection under № 417056.
Art. 2. (1) Excedo collects and processes personal data submitted by Clients for the purposes of providing the Services under the booking contract with respective Clients, including with regard to the following:
- accounting purposes;
- statistical purposes;
- ensuring information security;
- ensuring the implementation of the booking contract for the respective service;
- dispute resolution between Clients and third parties;
- ensuring security and compliance with the applicable legislation and requirements of the booking contract;
(2) Excedo shall observe the following principles when processing Clients’ personal data:
- lawfulness and a bona fide approach;
- specific determination of possessing purposes;
- relevance with regard to possessing purposes;
- accuracy and currentness;
- Clients’ consent to data processing.
Art. 3. (1) Excedo shall not collect and process personal data and Clients shall not disclose such data which:
- reveals racial or ethnic origin;
- reveals political, religious or philosophic beliefs, membership in political parties or organizations, associations of a religious, philosophical, political or trade union nature;
- relates to overall health, sexual life or the human genome;
(2) Para. 1 shall not be applicable in cases pursuant to Art. 5, Para. 2 of the Law for Protection of Personal Data.
Art. 4. (1) In collecting and processing Clients’ personal data, Excedo shall ensure a sufficient degree of protection against accidental or unlawful destruction or accidental loss, unauthorized access, modification or distribution, as well as other illegal forms of processing, in accordance with the current development of information technologies.
(2) Clients shall be diligent with regard to storing and protecting their personal data when providing it to Excedo.
(3) Clients shall be required to maintain the correctness of personal data provided to Excedo.
Art. 5. In cases when personal data has been received from the Client it relates to, Excedo shall be entitled to provide to that Client in each case, and after initial assessment of the need for such provision in order to ensure fair processing of data relating to the respective natural person, the following information:
- recipients or recipient categories to whom data may be disclosed;
- information on the obligatory or voluntary nature of disclosing data and the consequences of refusing to do so;
- information on right of access and right to adjust collected data.
Art. 6. Excedo shall provide Clients with access to personal data collected through the conclusion of the booking contract for the respective services upon explicit request.
Art. 7. Excedo shall provide the Commission for Personal Data Protection with access to the registers it keeps and shall not hinder control over data processing.
Art. 8. Excedo shall disclose Clients’ personal data to state authorities after receiving an explicit written order and in cases provided by law, as well as to an extent not exceeding the purposes for which such data is being requested.
Art. 9. After achieving the objectives of processing Clients’ personal data, Excedo shall destroy the data or transfer it to another personal data administrator, observing the requirement under Art. 25, Para. 1 of the Law for Protection of Personal Data.
Art. 10. (1) Clients shall be entitled to access personal data, which relates to them, after submitting a respective request to Excedo.
(2) Excedo shall provide access only to data relating to the respective natural person, who has submitted the request for access.
Art. 11. (1) The natural person, to whom the data relates, shall be entitled to request from Excedo at any time the following:
- confirmation as to whether their data is being processed, information on the purposes of such processing, data categories and recipients or recipient categories to whom data is being disclosed;
- notification in an intelligible form, containing the individual’s personal data subject to processing, as well as any available information on data sources;
- information on the logic behind any automatic personal data processing, relating to that person.
(2) The natural person, whose data is being processed, shall be entitled to require actions under Para. 1 free of charge once every 12 months at most.
Art. 12. The natural person, whose data is being processed by Excedo, shall be at any time entitled to request from the latter:
- to delete, adjust or block their personal data, should its processing not meet the requirements of the Law for Protection of Personal Data;
- to inform third parties, to whom personal data has been disclosed, of any deletion, adjustment or blocking carried out in accordance with the above sentence, except in cases when this is impossible or involves excessive efforts.
Art. 13. (1) Requests submitted to Excedo under the current policy shall include at least the following:
- name, address and other data for the identification of the respective natural person;
- description of what is being requested;
- the preferred form for provision of information;
- signature, submission date of the request and mailing address.
(2) When the request is being submitted by a proxy, a notarized power of attorney needs to be enclosed.
Art. 14. (1) Excedo shall make a decision with regard to the natural person’s request pursuant to Art. 13, Para. 1 within 14 working days from its submission.
(2) The term under Para. 1 may be extended by Excedo up to 30 working days, should gathering all requested data objectively require a longer time and thus, seriously hamper Excedo’s activities.
(3) Excedo shall notify the natural person, who has submitted the request in writing, if their request shall be honored or else, send a reasoned refusal. The notification shall be provided by Excedo to the natural person via registered mail or in person, against signature.
(4) The lack of notification by Excedo to the natural person under this article shall be considered a refusal.
Art. 15. The natural person, to whom the data relates, shall be entitled to:
- object before Excedo as regards the processing of their personal data, should there be legal grounds to do so; should such opposition be deemed justified, the personal data of the individual may no longer be processed;
- object to the processing of their personal data for the purposes of direct marketing;
- receive notification before their personal data is disclosed to third parties for the first time or used on their behalf for the purposes of Pt. 2, and be given the opportunity to object to such disclosure or use.
Art. 16. (1) The natural person agrees that Excedo has the right to store information or gain access to information stored in the terminal equipment of the recipient of services offered by Excedo (cookies).
(2) Excedo shall ensure that the service recipient has the opportunity to receive information on data stored in terminal equipment at any time. The respective natural person shall exercise that right by sending an inquiry via email to Excedo and by legitimization through their ID card.
(3) If a natural person has not expressly objected to information storing or gaining access to information stored on terminal equipment, Excedo shall be entitled to carry out these actions without the individual’s explicit consent. The natural person shall have the opportunity to submit an objection under the current article via Excedo’s main internet site.
(4) Excedo grants no explicit opportunity to natural persons to disagree with this article in cases of provision of service of information society, which is expressly requested by the recipient of the service of information society.
Art. 18. Excedo’s website uses Google Adsense, a web screens service provided by Google Inc., USA (” Google ”). Google Adsense uses “cookies”, which are text files placed on a Client’s computer, to help the website analyze how users use the site. Google Adsense also uses so-called “Web Beacons” (small invisible images) to gather information. Through the use of Web beacons simple actions such as the visitor traffic to the website can be recorded and collected. The information generated by the cookie and/or Web Beacon about a Client’s use of the website (including their IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information to evaluate a Client’s use of the website with regard to the ads, compiling reports on website activity and ads for website operators and providing others with website and internet related services. Google may also transfer this information to third parties where required by law or where such third parties process the information on Google’s behalf. Google will not associate a Client’s IP address with any other data held by Google. Clients can avoid storing cookies on their hard drive and the display of Web Beacons by choosing ‘Do not accept cookies’ in your browser settings ” (in MS Internet Explorer under ” Tools> Internet Options> Privacy> Settings ” , in Firefox under ” Tools> Settings> Privacy> Cookies ”); however, we point out that this may result in incomplete use all features of this website. By using this website, Clients consent to the processing of data about them by Google in the manner and for the purposes set out above.
Bulgarian competent authority:
Commission for Personal Data Protection
a: Sofia 1592 Prof. Tsvetan Lazarov Str. № 2,
t: (02) 940 20 46, fax: (02) 940 36 40
e: firstname.lastname@example.org, email@example.com